Netty codec-rtsp EUVD-2026-82934

Requires a reachable RTSP endpoint served by Netty's codec-rtsp (RtspDecoder). No authentication, user interaction, or non-default option is needed to trigger the trim-before-cache bug itself - any wire-delivered request whose method token ends in a byte with code point <=0x20 immediately before the separating space is silently normalized to a valid cached method. The meaningful SECURITY impact, however, is gated on a downstream disagreement: a front-end proxy, WAF, gateway, or access-control layer that parses the RTSP method differently than Netty must exist for method/request smuggling to yield real integrity effects; against a standalone Netty RTSP server with no differential parser, the request simply resolves to a method the backend already honors. Limiting factors: RTSP listeners are far less commonly exposed than HTTP, so real deployment exposure is narrow.

Vendor (Red Hat) CVSS 3.1 is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - a remote, unauthenticated, low-complexity network flaw with pure integrity impact (C:N/A:N). The integrity rating reflects RTSP method-token confusion: RtspMethods.valueOf() trims trailing control bytes (any code point <=0x20) before the cache lookup, so a wire token like 'PLAY\x00' or 'PLAY\r' is decoded as a fully-successful, cache-identical PLAY request that the application layer cannot distinguish from a clean one. This is a request/method-smuggling primitive (CWE-444 class), not a memory-safety RCE, so the standalone 7.5 is best read as a MEDIUM-real-priority issue whose actual exploitability depends on a downstream differential parser or fronting proxy that disagrees with Netty about where the method ends - absent that desync, the impact is limited to a normalized method the backend already accepts. No EPSS score, no CISA KEV entry, and no packaged POC are present, though the description embeds a minimal wire-level reproduction. Signals are consistent (no KEV/EPSS to contradict the score) but the assigned CWE-1035 is a taxonomy category rather than a real weakness, and the 'Information Disclosure' tag conflicts with the vendor's own C:N vector - both are metadata errors, not risk signals. Net: real but conditional integrity risk (needs a smuggling/desync context), not a drop-everything RCE.

An unauthenticated attacker sends a raw RTSP request whose method token carries a trailing control byte (e.g. 'PLAY\x00 ' or 'PLAY\r ') to any Netty-based RTSP server; RtspDecoder trims the byte and yields decoderResult().isSuccess()true with method()RtspMethods.PLAY (the cached singleton), so the app processes it as a legitimate PLAY. Where a security proxy, WAF, or logging layer sits in front and parses the method differently, this discrepancy enables request/method smuggling - bypassing method-based access controls or slipping a token past inspection. The description includes a minimal wire-level reproduction, but no weaponized/public exploit is identified at time of analysis.